Towards Secure Open Banking Architecture: An Evaluation with OWASP

Deina Kellezi; Christian Boegelund; Weizhi Meng

doi:10.1007/978-3-030-36938-5_11

Towards Secure Open Banking Architecture: An Evaluation with OWASP

Deina Kellezi, Christian Boegelund, Weizhi Meng^*

^*Corresponding author for this work

Department of Applied Mathematics and Computer Science

Technical University of Denmark

Research output: Chapter in Book/Report/Conference proceeding › Article in proceedings › Research › peer-review

836 Downloads (Pure)

Abstract

The European Union passed the PSD2 regulation in 2015, which gives ownership of bank accounts to the private person owning it. As a result, the term Open Banking, allowing third party providers and developers access to bank APIs, has emerged, welcoming a myriad of innovative solutions for the financial sector. However, multiple cyber security issues arise from exposing bank data to third party providers through an API. In this work, we propose an architectural model that ensures clear separation of concern and easy integration with Nordea’s Open Banking APIs (sandbox version), and a technological stack, consisting of the micro-framework Flask, the cloud application platform Heroku and persistent data storage layer (using Postgres). We analyze the web application’s security threats, and determine whether or not the technological frame provides adequate security protection, by leveraging the OWASP Top 10 list of the Ten Most Critical Web Application Security Risks. Our results can support future developers and industries working on web applications for Open Banking towards security improvement by choosing the right frameworks and considering the most important vulnerabilities, as well as contributing to the documentation and development of Nordea’s APIs.

Original language	English
Title of host publication	Network and System Security
Editors	Joseph K. Liu, Xinyi Huang
Publisher	Springer
Publication date	1 Jan 2019
Pages	185-198
ISBN (Print)	9783030369378
DOIs	https://doi.org/10.1007/978-3-030-36938-5_11
Publication status	Published - 1 Jan 2019
Event	13th International Conference on Network and System Security - Sapporo, Japan Duration: 15 Dec 2019 → 18 Dec 2019

Conference

Conference	13th International Conference on Network and System Security
Country/Territory	Japan
City	Sapporo
Period	15/12/2019 → 18/12/2019

Series	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	11928 LNCS
ISSN	0302-9743

Keywords

Open Banking API
OWASP
PSD2 regulation
Secure architecture
Threat and risk
Web security

Access to Document

10.1007/978-3-030-36938-5_11

FulltextAccepted author manuscript, 376 KB

OpenUrl availability

Full text

Cite this

Kellezi, Deina ; Boegelund, Christian ; Meng, Weizhi. / Towards Secure Open Banking Architecture : An Evaluation with OWASP. Network and System Security. editor / Joseph K. Liu ; Xinyi Huang. Springer, 2019. pp. 185-198 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 11928 LNCS).

@inproceedings{212db1bab84b45739e684542dfb3e55c,

title = "Towards Secure Open Banking Architecture: An Evaluation with OWASP",

abstract = "The European Union passed the PSD2 regulation in 2015, which gives ownership of bank accounts to the private person owning it. As a result, the term Open Banking, allowing third party providers and developers access to bank APIs, has emerged, welcoming a myriad of innovative solutions for the financial sector. However, multiple cyber security issues arise from exposing bank data to third party providers through an API. In this work, we propose an architectural model that ensures clear separation of concern and easy integration with Nordea{\textquoteright}s Open Banking APIs (sandbox version), and a technological stack, consisting of the micro-framework Flask, the cloud application platform Heroku and persistent data storage layer (using Postgres). We analyze the web application{\textquoteright}s security threats, and determine whether or not the technological frame provides adequate security protection, by leveraging the OWASP Top 10 list of the Ten Most Critical Web Application Security Risks. Our results can support future developers and industries working on web applications for Open Banking towards security improvement by choosing the right frameworks and considering the most important vulnerabilities, as well as contributing to the documentation and development of Nordea{\textquoteright}s APIs.",

keywords = "Open Banking API, OWASP, PSD2 regulation, Secure architecture, Threat and risk, Web security",

author = "Deina Kellezi and Christian Boegelund and Weizhi Meng",

year = "2019",

month = jan,

day = "1",

doi = "10.1007/978-3-030-36938-5_11",

language = "English",

isbn = "9783030369378",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "185--198",

editor = "Liu, {Joseph K.} and Xinyi Huang",

booktitle = "Network and System Security",

note = "13th International Conference on Network and System Security, NSS 2019 ; Conference date: 15-12-2019 Through 18-12-2019",

}

Kellezi, D, Boegelund, C & Meng, W 2019, Towards Secure Open Banking Architecture: An Evaluation with OWASP. in JK Liu & X Huang (eds), Network and System Security. Springer, Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 11928 LNCS, pp. 185-198, 13th International Conference on Network and System Security, Sapporo, Japan, 15/12/2019. https://doi.org/10.1007/978-3-030-36938-5_11

Towards Secure Open Banking Architecture: An Evaluation with OWASP. / Kellezi, Deina; Boegelund, Christian; Meng, Weizhi.
Network and System Security. ed. / Joseph K. Liu; Xinyi Huang. Springer, 2019. p. 185-198 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 11928 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Article in proceedings › Research › peer-review

TY - GEN

T1 - Towards Secure Open Banking Architecture

T2 - 13th International Conference on Network and System Security

AU - Kellezi, Deina

AU - Boegelund, Christian

AU - Meng, Weizhi

PY - 2019/1/1

Y1 - 2019/1/1

N2 - The European Union passed the PSD2 regulation in 2015, which gives ownership of bank accounts to the private person owning it. As a result, the term Open Banking, allowing third party providers and developers access to bank APIs, has emerged, welcoming a myriad of innovative solutions for the financial sector. However, multiple cyber security issues arise from exposing bank data to third party providers through an API. In this work, we propose an architectural model that ensures clear separation of concern and easy integration with Nordea’s Open Banking APIs (sandbox version), and a technological stack, consisting of the micro-framework Flask, the cloud application platform Heroku and persistent data storage layer (using Postgres). We analyze the web application’s security threats, and determine whether or not the technological frame provides adequate security protection, by leveraging the OWASP Top 10 list of the Ten Most Critical Web Application Security Risks. Our results can support future developers and industries working on web applications for Open Banking towards security improvement by choosing the right frameworks and considering the most important vulnerabilities, as well as contributing to the documentation and development of Nordea’s APIs.

AB - The European Union passed the PSD2 regulation in 2015, which gives ownership of bank accounts to the private person owning it. As a result, the term Open Banking, allowing third party providers and developers access to bank APIs, has emerged, welcoming a myriad of innovative solutions for the financial sector. However, multiple cyber security issues arise from exposing bank data to third party providers through an API. In this work, we propose an architectural model that ensures clear separation of concern and easy integration with Nordea’s Open Banking APIs (sandbox version), and a technological stack, consisting of the micro-framework Flask, the cloud application platform Heroku and persistent data storage layer (using Postgres). We analyze the web application’s security threats, and determine whether or not the technological frame provides adequate security protection, by leveraging the OWASP Top 10 list of the Ten Most Critical Web Application Security Risks. Our results can support future developers and industries working on web applications for Open Banking towards security improvement by choosing the right frameworks and considering the most important vulnerabilities, as well as contributing to the documentation and development of Nordea’s APIs.

KW - Open Banking API

KW - OWASP

KW - PSD2 regulation

KW - Secure architecture

KW - Threat and risk

KW - Web security

U2 - 10.1007/978-3-030-36938-5_11

DO - 10.1007/978-3-030-36938-5_11

M3 - Article in proceedings

AN - SCOPUS:85076996483

SN - 9783030369378

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 185

EP - 198

BT - Network and System Security

A2 - Liu, Joseph K.

A2 - Huang, Xinyi

PB - Springer

Y2 - 15 December 2019 through 18 December 2019

ER -

Kellezi D, Boegelund C, Meng W. Towards Secure Open Banking Architecture: An Evaluation with OWASP. In Liu JK, Huang X, editors, Network and System Security. Springer. 2019. p. 185-198. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 11928 LNCS). doi: 10.1007/978-3-030-36938-5_11

Towards Secure Open Banking Architecture: An Evaluation with OWASP

Abstract

Conference

Keywords

Access to Document

OpenUrl availability

Fingerprint

Cite this